Database/Container, Kubernetes & orchestration
Argo Workflows (controller, expression template evaluation of input parameters): When EXPRESSION_TEMPLATES is on and
Impact
When EXPRESSION_TEMPLATES is on and untrusted users can set workflow input parameters, the supplied value gets evaluated as an expression template. A tenant can disrupt or distort another workflow's execution by feeding in crafted parameters rather than plain data.
Who can reach it
Any user permitted to specify input parameters on a workflow run, on a controller with expression templates enabled.
What to do
Upgrade the controller to 3.1.6 or later and restart. If you cannot upgrade immediately, disable EXPRESSION_TEMPLATES or stop accepting workflow input parameters from untrusted principals.
References
Related entries
- Apache CloudStack CKS: cross-tenant manipulation of Kubernetes clusters when adding or removing nodesCVE-2026-62440 · Apache CloudStack Kubernetes Service (CKS) plugin - node add/remove pathUnscored
- Argo Workflows (Argo Server, TLS keys baked into the container image): Argo Server's TLS private keys ship inside theNCVD-2021-013-argo-workflows-argo-server-tls-k · Argo Workflows (Argo Server, TLS keys baked into the container image)Unscored
- Argo Workflows (Argo Server, --auth-mode=client on Kubernetes 1.19+ outside a pod): In this configuration the client'sNCVD-2021-014-argo-workflows-argo-server-auth · Argo Workflows (Argo Server, --auth-mode=client on Kubernetes 1.19+ outside a pod)Unscored
- Argo Workflows (Argo Server default --auth-mode=server before 3.0): Before 3.0 the Argo Server defaulted toNCVD-2021-015-argo-workflows-argo-server-defau · Argo Workflows (Argo Server default --auth-mode=server before 3.0)Unscored
- Argo Workflows (Argo Server, TLS keys baked into the container image): Argo Server's TLS private keys ship inside theNCVD-2021-018-argo-workflows-argo-server-tls-k · Argo Workflows (Argo Server, TLS keys baked into the container image)Unscored
- Argo Workflows (Argo Server, --auth-mode=client on Kubernetes 1.19+ outside a pod): In this configuration the client'sNCVD-2021-019-argo-workflows-argo-server-auth · Argo Workflows (Argo Server, --auth-mode=client on Kubernetes 1.19+ outside a pod)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.